$2,500
One Shopify store with up to 10 tracking vendors
When a visitor opts out, does your tracking stop?
An add-on to any Evaluate. We load your store as visitors who accept, reject or send an opt-out signal, and record every tracking vendor that loads and where it comes from. Every finding is verified by hand.
Context, with sources
Most stores add pixels through their theme, apps and Tag Manager over the years. Each one decides for itself whether to listen to the visitor’s choice.
California’s regulations require a business that sells or shares personal information to treat an opt-out preference signal, such as Global Privacy Control, as a valid opt-out. Since January 1, 2026 it must also show the visitor whether the signal was processed. CalPrivacy: things to know before the 2026 CCPA updates
At least a dozen states, including California, Colorado, Connecticut, Oregon and Texas, require covered businesses to honor these signals. CalPrivacy Board: opt-out preference signals briefing (2026)
From January 1, 2027, California requires browser makers to offer a built-in setting that sends the signal, so it will no longer be limited to privacy-focused browsers. California AB 566, Civil Code 1798.136
Shopify’s banner governs Shopify’s own tools and pixels. Shopify notes that pixels installed by hand or through apps may need a consent app or custom code. Shopify Help Center: customer privacy settings
In March 2026, a California Privacy Protection Agency decision required a business to audit the tracking technologies on its website and make sure it honors opt-out preference signals, including Global Privacy Control. CalPrivacy: Ford decision, March 2026
Privacy & Tracking Check
What does your store do for a visitor who says no?
$750with an Evaluate · $950 on its own.Five business days. Sold as an add-on, by referral from cyber insurance brokers, or on request.
Until our automated scanner passes its accuracy checks, every finding is verified by hand, and privacy results are delivered only inside paid work. This is a technical record, not legal advice.
The Check fee is credited in full to a Privacy Fix signed within 60 days.
The Check includes
- Your home, collection, product and cart pages loaded in a real browser as three visitors: a California visitor who makes no choice, the same visitor with Global Privacy Control on, and a visitor from the EU or UK
- Every tracking vendor that loads, what it receives, and where it comes from: theme code, an app, Google Tag Manager or a Shopify pixel
- Your banner’s Accept and Reject paths compared, and whether your “Do Not Sell or Share” link and opt-out confirmation work
- Session-recording tools flagged, with what they can capture
- The vendors your privacy policy names compared with the vendors we saw
- Screenshots and network recordings for every finding, a fix list and a 30-minute readout call
Every report also carries the free hygiene section: HTTPS, security headers, and automated accessibility indicators, including whether an accessibility overlay widget is installed. These are indicators, not a security or accessibility audit.
What the report shows
One row per vendor, one column per visitor. This example is made up to show the format; it is not a scan of any real store.
| Vendor | Loaded by | No choice yet | GPC on | Rejected banner | In privacy policy |
|---|---|---|---|---|---|
| Meta Pixel | Hard-coded in the theme | Loads | Loads | Loads | Named |
| Google Ads tag | Google Tag Manager | Loads | Loads | Blocked | Named |
| Session recording tool | App embed | Loads | Loads | Loads | Not named |
| Pinterest tag | Shopify customer event | Loads | Blocked | Blocked | Named |
In a real report each cell links to the screenshot and network recording behind it, with the date and time.
Privacy Fix
We connect every tag to the visitor’s choice, then prove it.
Fixed prices for Shopify stores. Other platforms: quoted after the Check. Usually two to three weeks.
$5,000
Shopify Plus, Google Tag Manager, custom or hard-coded pixels, up to 25 vendors
Included in both
- Tags and pixels in your theme, apps and Tag Manager held until consent where it is required, and stopped for visitors who opt out
- Global Privacy Control read in the browser and on the server, and the opt-out confirmation shown to the visitor
- Shopify’s free privacy settings or the consent app you already use, configured and connected to Shopify’s Customer Privacy API
- Google Consent Mode set up where you use Google tags
- A vendor list your counsel can use to update your privacy policy
- The Check re-run after the fix, with the recording
We don’t write or rewrite privacy policies, answer data requests, or give legal advice. We hand your counsel an accurate vendor list and the evidence.
Privacy re-test
$750per re-test
The same visitors and pages re-run, with a dated evidence pack.
We sell re-tests rather than a monthly alert feed. New pixels arrive when someone installs an app or edits the theme; a dated re-test after those changes shows whether the fix still holds.
Privacy Check questions
Is this a legal compliance audit? No. We record what your store does for set visitor profiles on a stated date, and we cite the rule each finding relates to. Whether a finding breaks a law that applies to you is for your counsel. If you prefer, engage us through your lawyer. We don’t issue scores, grades or certificates.
Do these rules apply to us? It depends on your revenue, how many residents of each state you serve, and whether you sell or share personal information as each law defines it. We can’t answer that for you; your counsel can, and our report gives them the facts they need.
We use Shopify’s banner or a consent app. Why test? Shopify says its banner governs Shopify’s own tools and pixels, and that pixels installed by hand or through apps may need a consent app or custom code. Consent apps only control the tags they know about. The Check shows which tags slip past both.
Automated scanners cost much less. What’s different? Several good automated tools test opt-out signals for under $200, and if one answers your question, use it. The Check adds three things: a person verifies every finding before you see it, each vendor is traced to the theme file, app or Tag Manager trigger that loads it, and the fee is credited to a fix that ends with a recorded re-test.
Do you install a consent banner? We configure Shopify’s free privacy settings or the consent app you already use, and connect your tags to it. We don’t sell a consent tool of our own and take no fees from consent vendors.
Will you scan our site without asking? Before a contract we only load public pages as an ordinary visitor would, and we share findings privately with the store. After you order, we test with your written go-ahead. We never probe for vulnerabilities, log in or submit forms.